319 Malicious Chrome Extensions Hijack User Searches
A long-running scheme affecting 13.4 million users exposes vulnerabilities in browser-based search syndication programs.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you trust browser extensions to handle your search history and personal data securely?
Researchers have identified 319 malicious Chrome extensions that hijacked user search queries to generate illicit referral income. This research-stage finding details a decade-long scheme that impacted 13.4 million users by redirecting traffic to Yahoo and Bing.
Why it matters
The discovery exposes systemic vulnerabilities in browser extension distribution, where operators exploit search syndication programs to monetize user traffic without disclosure. This activity highlights the challenge of policing the browser ecosystem against mass-scale ad-revenue manipulation.
The extensions use the chrome_settings_overrides.search_provider manifest setting to force browser traffic through operator-controlled servers. These tools are often marketed as PDF converters or AI search helpers to mask their underlying search syndication revenue models.
The players
Socket.dev
A supply chain security firm that monitors open-source and browser extension ecosystems for malicious code patterns.
Intango LTD
A digital advertising entity linked to the operation of 111 identified malicious extensions.
SecuryBrowse
A software operator identified as being linked to 58 extensions affecting 4.9 million users.
John Tuckner
An independent security researcher who identified 264 additional extensions involved in the hijacking activity.
The details
The malicious extensions manipulate the browser search configuration, specifically targeting the default search engine setting. By routing queries through third-party infrastructure, operators participate in search syndication programs, which share advertising revenue between the search provider and the referral source. This allows entities like Intango LTD and SecuryBrowse to monetize redirected traffic silently.
Timeline
2016: The search hijacking activity began.
October 29, 2026: Researchers published findings detailing the investigation.
The Tech Race
This activity underscores a persistent gap in the Chrome Web Store security vetting process regarding ad-revenue redirection. These findings indicate that malicious actors continue to outpace automated detection systems when monetizing browser search traffic.
Users should audit their installed Chrome extensions, specifically checking for tools marketed as PDF converters or search helpers. Reviewing the default search provider setting in browser preferences is the primary way to determine if traffic is currently being hijacked.
The takeaway
This discovery confirms that browser extensions remain a primary attack vector for long-term, low-visibility monetization schemes. Users should watch for future platform-wide security updates from browser vendors intended to restrict access to search provider settings.
Further reading
For more on evolving browser-based threats and platform security, visit the Cybersecurity section.
Live Poll
Do you trust browser extensions to handle your search history and personal data securely?
